test: cover /resources/radar-reports end to end against its corpus

[hivecommons-hive]

Test Improvement

Adds tests/e2e/radar-reports.spec.js, the first spec dedicated to
/resources/radar-reports — the only route that renders
src/components/RadarReports.

The route was already reached by the e2e suite, but only at smoke depth.
tests/e2e/smoke.spec.js:81-93 asserts that the section is visible, that it
holds more than zero <li>, and that the first link is absolute. Two
regressions clear that bar, both confirmed against a npm run build:production
output at 7772dcf with the existing suite staying green:

1. Rendering (data.radarReports || []).slice(0, -1) publishes five of the six
   reports in the corpus. "More than zero <li>" is satisfied by five.
2. Deleting rel="noreferrer" from the report title anchor leaves every
   target="_blank" report link able to reach back through window.opener.
   The smoke test never inspects rel.

tests/e2e/footer.spec.js:99 and tests/e2e/metrics-dashboard.spec.js:49-58
already assert rel=noreferrer against the hydrated document; this route was
the remaining external-link surface that did not.

The unit suite (tests/radar-reports.test.mjs,
tests/radar-reports-fallbacks.test.mjs) reports 100% line and branch coverage
for the component, but drives the JSX through tests/tools/fake-dom.mjs against
a synthetic corpus — it never renders data/radar-reports.json and never builds
a document outline. The corpus is rebuilt daily from cncf.io by
.github/workflows/refresh-radar-reports.yml, so the page can change with no
source change at all.

What the spec asserts

Data-driven against data/radar-reports.json, following
tests/e2e/metrics-dashboard.spec.js rather than pinning published content:

• one <li> per corpus entry, and rendered title hrefs equal the corpus URLs
  in order (the collector writes newest-first; the component maps as-is)
• each entry pairs its title link with a date and its summary
• the report headings are a flat set of <h3>
• the provenance line credits data.sourceUrl and renders a real formatted
  date, catching an Invalid Date reaching the page
• every target="_blank" link in the section carries rel=noreferrer
• every report href is absolute https://

Each case was mutation-checked: (1) fails cases 1-3 and 5-6, (2) fails case 5.

Timezone note

Dates are asserted by shape, not by value. The component formats with
toLocaleDateString('en-US', ...), which resolves against the renderer's
timezone, so the date-only 2026-09-07 renders as "September 6, 2026" on a
build west of UTC — observed in the current build/ output. Asserting the exact
day would encode the build host's timezone into the suite.

Validation

• npx playwright test tests/e2e/radar-reports.spec.js — 6 passed (chromium,
  against npm run build:production)
• npx playwright test tests/e2e/radar-reports.spec.js tests/e2e/smoke.spec.js
  — 14 passed, no regression to the existing smoke coverage
• npx prettier --check and npx eslint clean
• tests/playwright-config.test.mjs, tests/module-imports.test.mjs — 17 passed

Test-only: no production code, no workflow files, no fixtures changed.

Disjointness

Touches exactly one new file, tests/e2e/radar-reports.spec.js, and the radar
cluster. No open PR claims it: #829 adds tests/e2e/docs-routes.spec.js
(/resources, /community/governance, platform-engineering); #832 is a unit
contract on docs/events/index.md; #825/#818/#820/#810/#812/#827 are unit tests
and fixes under scripts/ and tests/*.test.mjs.

Related Issue

Closes #833

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "quality". If this is an outreach PR, a human must review it and remove the label.